Informational 15 Bitcoin Committed Mar 19, 2026 · 09:09 UTC

ci(release-emu): extract reusable core and legacy emulator build actions

79d5b1f9 View source ↗

Public commit record

What the developer wrote

Authored by danielhladik-sl

85/100 · Strong

ci(release-emu): extract reusable core and legacy emulator build actions

Add .github/actions/build-core-emu and .github/actions/build-legacy-emu as composite actions.

Refactor release emulator workflow jobs to call these actions instead of duplicating shell steps.

Keep existing outputs and deployment behavior (S3 upload; artifact upload for core builds).

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context

The short version

What changed, and why it matters

This commit is a routine cleanup of the project's automated build scripts. It extracts repeated emulator build steps into reusable GitHub Actions components without changing what gets built, how it gets uploaded, or who can access it. There is no indication this affects the security of Trezor devices or their firmware.

Recommended action

No security action required. Review as normal CI refactoring if desired.

Security signals we found

No strong security signals were identified.

Technical analysis

Evidence from the diff

The commit refactors .github/workflows/release-emu.yml by moving duplicated core and legacy emulator build/upload steps into two new composite actions: .github/actions/build-core-emu/action.yml and .github/actions/build-legacy-emu/action.yml. The same build commands (nix-shell, make, cibuild), AWS credential configuration, S3 upload paths, and artifact upload settings are preserved. The only functional differences are structural: removal of continue-on-error on AWS credential configuration and use of cp instead of mv for non-arm core binaries. These are minor workflow behavior changes, not security vulnerabilities.

Changed components

.github/workflows/release-emu.yml.github/actions/build-core-emu/action.yml.github/actions/build-legacy-emu/action.yml

Inspect captured patch +133 / −118

diff --git a/.github/actions/build-core-emu/action.yml b/.github/actions/build-core-emu/action.yml
new file mode 100644
index 00000000..02da2542
--- /dev/null
+++ b/.github/actions/build-core-emu/action.yml
@@ -0,0 +1,67 @@
+name: 'Build core emulator'
+description: 'Build, upload to S3, and store core emulator artifact'
+inputs:
+  model:
+    description: 'Trezor model'
+    required: true
+  version:
+    description: 'Version string'
+    required: true
+  artifact-name:
+    description: 'Artifact name'
+    required: true
+  binary-suffix:
+    description: 'Binary suffix appended to version, e.g. -arm'
+    required: false
+    default: ''
+  s3-subpath:
+    description: 'Optional extra S3 subpath under model path, e.g. T3W1_tropic_on/'
+    required: false
+    default: ''
+  build-bootloader:
+    description: 'Build bootloader before unix emulator build'
+    required: false
+    default: 'true'
+runs:
+  using: 'composite'
+  steps:
+    - uses: ./.github/actions/environment
+
+    - run: nix-shell --run "uv run make -C core build_bootloader_emu"
+      if: inputs.build-bootloader == 'true'
+      shell: sh
+
+    - run: nix-shell --run "uv run make -C core build_unix_frozen"
+      shell: sh
+
+    - id: prepare_binary
+      run: |
+        TARGET="core/build/unix/trezor-emu-core-${{ inputs.model }}-v${{ inputs.version }}${{ inputs.binary-suffix }}"
+        if [ "${{ inputs.binary-suffix }}" = "-arm" ]; then
+          mv core/build/unix/trezor-emu-core "$TARGET"
+        else
+          cp core/build/unix/trezor-emu-core "$TARGET"
+        fi
+        echo "binary_path=$TARGET" >> "$GITHUB_OUTPUT"
+      shell: sh
+
+    - name: Configure aws credentials
+      if: github.repository == 'trezor/trezor-firmware'
+      uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7  # aws-actions/configure-aws-credentials@v6.0.0
+      with:
+        role-to-assume: arn:aws:iam::538326561891:role/gh_actions_deploy_dev_firmware_data
+        aws-region: eu-west-1
+
+    - name: Upload emulator binaries
+      if: github.repository == 'trezor/trezor-firmware'
+      run: |
+        aws s3 cp "${{ steps.prepare_binary.outputs.binary_path }}" "s3://data.trezor.io/dev/firmware/releases/emulators-new/${{ inputs.model }}/${{ inputs.s3-subpath }}"
+      shell: sh
+
+    - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # actions/upload-artifact@v7.0.0
+      with:
+        name: ${{ inputs.artifact-name }}
+        path: |
+          core/build/unix/trezor-emu-core*
+          core/build/bootloader_emu/bootloader.elf
+        retention-days: 7
diff --git a/.github/actions/build-legacy-emu/action.yml b/.github/actions/build-legacy-emu/action.yml
new file mode 100644
index 00000000..6162d65f
--- /dev/null
+++ b/.github/actions/build-legacy-emu/action.yml
@@ -0,0 +1,37 @@
+name: 'Build legacy emulator'
+description: 'Build legacy emulator and upload it to S3'
+inputs:
+  version:
+    description: 'Version string'
+    required: true
+  binary-suffix:
+    description: 'Binary suffix appended to version, e.g. -arm'
+    required: false
+    default: ''
+runs:
+  using: 'composite'
+  steps:
+    - uses: ./.github/actions/environment
+
+    - run: nix-shell --run "uv run legacy/script/cibuild"
+      shell: sh
+
+    - id: prepare_binary
+      run: |
+        TARGET="legacy/firmware/trezor-emu-legacy-T1B1-v${{ inputs.version }}${{ inputs.binary-suffix }}"
+        mv legacy/firmware/trezor.elf "$TARGET"
+        echo "binary_path=$TARGET" >> "$GITHUB_OUTPUT"
+      shell: sh
+
+    - name: Configure aws credentials
+      if: github.repository == 'trezor/trezor-firmware'
+      uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7  # aws-actions/configure-aws-credentials@v6.0.0
+      with:
+        role-to-assume: arn:aws:iam::538326561891:role/gh_actions_deploy_dev_firmware_data
+        aws-region: eu-west-1
+
+    - name: Upload emulator binaries
+      if: github.repository == 'trezor/trezor-firmware'
+      run: |
+        aws s3 cp "${{ steps.prepare_binary.outputs.binary_path }}" "s3://data.trezor.io/dev/firmware/releases/emulators-new/T1B1/"
+      shell: sh
diff --git a/.github/workflows/release-emu.yml b/.github/workflows/release-emu.yml
index 828b11f3..c6450511 100644
--- a/.github/workflows/release-emu.yml
+++ b/.github/workflows/release-emu.yml
@@ -91,30 +91,12 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # actions/checkout@v6.0.2
         with:
           submodules: recursive
-      - uses: ./.github/actions/environment
-      - run: nix-shell --run "uv run make -C core build_bootloader_emu"
-        if: matrix.coins == 'universal'
-      - run: nix-shell --run "uv run make -C core build_unix_frozen"
-      - run: cp core/build/unix/trezor-emu-core core/build/unix/trezor-emu-core-${{ matrix.model }}-v${{ needs.get_models.outputs.version }}
-
-      - name: Configure aws credentials
-        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7  # aws-actions/configure-aws-credentials@v6.0.0
+      - uses: ./.github/actions/build-core-emu
         with:
-          role-to-assume: arn:aws:iam::538326561891:role/gh_actions_deploy_dev_firmware_data
-          aws-region: eu-west-1
-        continue-on-error: true
-
-      - name: Upload emulator binaries
-        run: |
-            aws s3 mv core/build/unix/trezor-emu-core-${{ matrix.model }}-v${{ needs.get_models.outputs.version }} s3://data.trezor.io/dev/firmware/releases/emulators-new/${{ matrix.model}}/
-
-      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # actions/upload-artifact@v7.0.0
-        with:
-          name: core-emu-${{ matrix.model }}-${{ matrix.coins }}-${{ matrix.type }}-${{ matrix.asan }}
-          path: |
-            core/build/unix/trezor-emu-core*
-            core/build/bootloader_emu/bootloader.elf
-          retention-days: 7
+          model: ${{ matrix.model }}
+          version: ${{ needs.get_models.outputs.version }}
+          artifact-name: core-emu-${{ matrix.model }}-${{ matrix.coins }}-${{ matrix.type }}-${{ matrix.asan }}
+          build-bootloader: ${{ matrix.coins == 'universal' }}
 
   core_emu_arm:
     if: startsWith(github.ref, 'refs/tags/core/v') || inputs.project == 'core'
@@ -141,30 +123,13 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # actions/checkout@v6.0.2
         with:
           submodules: recursive
-      - uses: ./.github/actions/environment
-      - run: nix-shell --run "uv run make -C core build_bootloader_emu"
-        if: matrix.coins == 'universal'
-      - run: nix-shell --run "uv run make -C core build_unix_frozen"
-      - run: mv core/build/unix/trezor-emu-core core/build/unix/trezor-emu-core-${{ matrix.model }}-v${{ needs.get_models.outputs.version }}-arm
-
-      - name: Configure aws credentials
-        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7  # aws-actions/configure-aws-credentials@v6.0.0
+      - uses: ./.github/actions/build-core-emu
         with:
-          role-to-assume: arn:aws:iam::538326561891:role/gh_actions_deploy_dev_firmware_data
-          aws-region: eu-west-1
-        continue-on-error: true
-
-      - name: Upload emulator binaries
-        run: |
-            aws s3 cp core/build/unix/trezor-emu-core-${{ matrix.model }}-v${{ needs.get_models.outputs.version }}-arm s3://data.trezor.io/dev/firmware/releases/emulators-new/${{ matrix.model}}/
-
-      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # actions/upload-artifact@v7.0.0
-        with:
-          name: core-emu-arm-${{ matrix.model }}-${{ matrix.coins }}-${{ matrix.type }}-${{ matrix.asan }}
-          path: |
-            core/build/unix/trezor-emu-core*
-            core/build/bootloader_emu/bootloader.elf
-          retention-days: 7
+          model: ${{ matrix.model }}
+          version: ${{ needs.get_models.outputs.version }}
+          artifact-name: core-emu-arm-${{ matrix.model }}-${{ matrix.coins }}-${{ matrix.type }}-${{ matrix.asan }}
+          binary-suffix: -arm
+          build-bootloader: ${{ matrix.coins == 'universal' }}
 
   core_emu_tropic_capable:
     if: startsWith(github.ref, 'refs/tags/core/v') || inputs.project == 'core'
@@ -192,30 +157,13 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # actions/checkout@v6.0.2
         with:
           submodules: recursive
-      - uses: ./.github/actions/environment
-      - run: nix-shell --run "uv run make -C core build_bootloader_emu"
-        if: matrix.coins == 'universal'
-      - run: nix-shell --run "uv run make -C core build_unix_frozen"
-      - run: cp core/build/unix/trezor-emu-core core/build/unix/trezor-emu-core-${{ matrix.model }}-v${{ needs.get_models.outputs.version }}
-
-      - name: Configure aws credentials
-        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7  # aws-actions/configure-aws-credentials@v6.0.0
-        with:
-          role-to-assume: arn:aws:iam::538326561891:role/gh_actions_deploy_dev_firmware_data
-          aws-region: eu-west-1
-        continue-on-error: true
-
-      - name: Upload emulator binaries
-        run: |
-            aws s3 mv core/build/unix/trezor-emu-core-${{ matrix.model }}-v${{ needs.get_models.outputs.version }} s3://data.trezor.io/dev/firmware/releases/emulators-new/${{ matrix.model}}/${{ matrix.model }}_tropic_on/
-
-      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # actions/upload-artifact@v7.0.0
+      - uses: ./.github/actions/build-core-emu
         with:
-          name: core-emu-tropic-capable-${{ matrix.model }}-${{ matrix.coins }}-${{ matrix.type }}-${{ matrix.asan }}
-          path: |
-            core/build/unix/trezor-emu-core*
-            core/build/bootloader_emu/bootloader.elf
-          retention-days: 7
+          model: ${{ matrix.model }}
+          version: ${{ needs.get_models.outputs.version }}
+          artifact-name: core-emu-tropic-capable-${{ matrix.model }}-${{ matrix.coins }}-${{ matrix.type }}-${{ matrix.asan }}
+          s3-subpath: ${{ matrix.model}}_tropic_on/
+          build-bootloader: ${{ matrix.coins == 'universal' }}
 
   core_emu_arm_tropic_capable:
     if: startsWith(github.ref, 'refs/tags/core/v') || inputs.project == 'core'
@@ -243,30 +191,14 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # actions/checkout@v6.0.2
         with:
           submodules: recursive
-      - uses: ./.github/actions/environment
-      - run: nix-shell --run "uv run make -C core build_bootloader_emu"
-        if: matrix.coins == 'universal'
-      - run: nix-shell --run "uv run make -C core build_unix_frozen"
-      - run: mv core/build/unix/trezor-emu-core core/build/unix/trezor-emu-core-${{ matrix.model }}-v${{ needs.get_models.outputs.version }}-arm
-
-      - name: Configure aws credentials
-        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7  # aws-actions/configure-aws-credentials@v6.0.0
-        with:
-          role-to-assume: arn:aws:iam::538326561891:role/gh_actions_deploy_dev_firmware_data
-          aws-region: eu-west-1
-        continue-on-error: true
-
-      - name: Upload emulator binaries
-        run: |
-            aws s3 cp core/build/unix/trezor-emu-core-${{ matrix.model }}-v${{ needs.get_models.outputs.version }}-arm s3://data.trezor.io/dev/firmware/releases/emulators-new/${{ matrix.model}}/${{ matrix.model }}_tropic_on/
-
-      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # actions/upload-artifact@v7.0.0
+      - uses: ./.github/actions/build-core-emu
         with:
-          name: core-emu-arm-tropic-capable-${{ matrix.model }}-${{ matrix.coins }}-${{ matrix.type }}-${{ matrix.asan }}
-          path: |
-            core/build/unix/trezor-emu-core*
-            core/build/bootloader_emu/bootloader.elf
-          retention-days: 7
+          model: ${{ matrix.model }}
+          version: ${{ needs.get_models.outputs.version }}
+          artifact-name: core-emu-arm-tropic-capable-${{ matrix.model }}-${{ matrix.coins }}-${{ matrix.type }}-${{ matrix.asan }}
+          binary-suffix: -arm
+          s3-subpath: ${{ matrix.model}}_tropic_on/
+          build-bootloader: ${{ matrix.coins == 'universal' }}
 
   legacy_emu:
     if: startsWith(github.ref, 'refs/tags/legacy/v') || inputs.project == 'legacy'
@@ -288,20 +220,9 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # actions/checkout@v6.0.2
         with:
           submodules: recursive
-      - uses: ./.github/actions/environment
-      - run: nix-shell --run "uv run legacy/script/cibuild"
-      - run: mv legacy/firmware/trezor.elf legacy/firmware/trezor-emu-legacy-T1B1-v${{ needs.get_models.outputs.version }}
-
-      - name: Configure aws credentials
-        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7  # aws-actions/configure-aws-credentials@v6.0.0
+      - uses: ./.github/actions/build-legacy-emu
         with:
-          role-to-assume: arn:aws:iam::538326561891:role/gh_actions_deploy_dev_firmware_data
-          aws-region: eu-west-1
-        continue-on-error: true
-
-      - name: Upload emulator binaries
-        run: |
-            aws s3 cp legacy/firmware/trezor-emu-legacy-T1B1-v${{ needs.get_models.outputs.version }} s3://data.trezor.io/dev/firmware/releases/emulators-new/T1B1/
+          version: ${{ needs.get_models.outputs.version }}
 
 
   legacy_emu_arm:
@@ -323,17 +244,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # actions/checkout@v6.0.2
         with:
           submodules: recursive
-      - uses: ./.github/actions/environment
-      - run: nix-shell --run "uv run legacy/script/cibuild"
-      - run: mv legacy/firmware/trezor.elf legacy/firmware/trezor-emu-legacy-T1B1-v${{ needs.get_models.outputs.version }}-arm
-
-      - name: Configure aws credentials
-        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7  # aws-actions/configure-aws-credentials@v6.0.0
+      - uses: ./.github/actions/build-legacy-emu
         with:
-          role-to-assume: arn:aws:iam::538326561891:role/gh_actions_deploy_dev_firmware_data
-          aws-region: eu-west-1
-        continue-on-error: true
-
-      - name: Upload emulator binaries
-        run: |
-            aws s3 cp legacy/firmware/trezor-emu-legacy-T1B1-v${{ needs.get_models.outputs.version }}-arm s3://data.trezor.io/dev/firmware/releases/emulators-new/T1B1/
+          version: ${{ needs.get_models.outputs.version }}
+          binary-suffix: -arm

Risk score

Why this scored 15/100

Our methodology →

Potential impact 0/30

Exploitability 0/25

Stealth signal 0/15

Affected reach 0/15

Confidence 10/10

Evidence quality 5/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 15/100

Community notes

Related watches

refactor(core): digest EIP-1559/EIP-7702 magic without RLP encoding

test(core): test RLP self-encoding bytestrings

chore(core): remove sha1 from regular FW